Set up a phone with hardware kill switches

A hardware kill switch is a physical toggle that electrically disconnects a component, such as the camera, microphone, radios, or battery, so it cannot be used no matter what the software does. The appeal is simple: software settings can be bypassed by malware or bugs, but a broken circuit cannot spy on you. This guide explains what kill switches genuinely protect against, who actually needs them, and how the main options compare.

What a kill switch actually protects against

The core promise is protection against software you do not control. If your microphone is physically disconnected, then even spyware with full access to your phone cannot listen, because there is no working microphone to reach. That is a real and meaningful guarantee, and it is stronger than any on-screen toggle.

Kill switches are most useful against:

• Malware or spyware that has already compromised the device and could otherwise activate the camera or microphone.
• Covert location tracking, if a switch disconnects the cellular and Wi-Fi radios so the phone stops talking to networks.
• Peace of mind in sensitive settings, such as a confidential meeting where you want certainty, not a promise, that nothing is recording.

They are less useful for everyday privacy problems like advertising trackers or data-broker profiling. Those ride on normal app and network activity while you are actively using the phone, so a physical switch you keep off would also switch off the phone’s usefulness. For those threats, the settings in our guide on how to lock down the phone you already have do more.

Who actually needs one

Be honest with yourself about your threat model, meaning who realistically might target you and how. Hardware kill switches make the most sense for:

• Journalists, activists, lawyers, and researchers who could plausibly be targeted by spyware.
• People handling genuinely sensitive information who need moments of guaranteed silence.
• Enthusiasts who value the assurance and accept the usability cost.

For most people, a mainstream phone with tracking switched off already addresses the threats they actually face, and a phone that is frequently switched into “dark” mode is a phone that misses calls and messages. Want the guarantee without the compromise all day? A Faraday bag (a pouch that blocks radio signals) is a cheap, flexible middle ground: drop any phone in it and it goes silent to cellular, Wi-Fi, Bluetooth, and GPS until you take it out. It does not cover the camera or microphone, but it is inexpensive, works with the phone you already own, and requires no new operating system.

Option 1: Purism Librem 5

The Librem 5 is the best-known kill-switch phone. It has three physical switches along the side that disconnect, respectively, the cellular modem, the Wi-Fi and Bluetooth radios, and the camera and microphone together. Flipping all three engages a “lockdown” state that also cuts other sensors, giving you a phone that is verifiably deaf, blind, and offline.

It runs PureOS, a Linux operating system, on open hardware, and starts around 799 US dollars (roughly 899 bundled with Purism’s mobile service) as of July 2026. The kill switches work exactly as advertised and are the phone’s standout feature.

The honest cost: this is a niche device. The processor and 3GB of RAM are modest, battery life is short, and the app selection is Linux software rather than the mainstream mobile apps most people depend on. Choose it because you specifically want open hardware with real kill switches and can live with the compromises, not as a general daily driver. It is covered in more depth in our guide on choosing a private phone.

Option 2: Unplugged UP Phone

The UP Phone takes a different approach. Rather than several radio switches, it offers a physical battery-disconnect kill switch that cuts power to the whole device, plus an always-on VPN and a hardened Android-based operating system. The battery switch is a genuine, hard guarantee that the phone is fully off, which addresses fears about a device that only appears to be powered down.

The trade-offs matter, and it is an expensive phone. As of July 2026 it costs around 989 US dollars, yet uses a MediaTek Dimensity 1200 chipset from 2021, so you pay flagship money for several-year-old, mid-range hardware. Its privacy services (VPN, messenger, cloud, antivirus) run on a subscription of about 12.99 US dollars per month or 129.99 per year after a first free year, and apps come through a closed app store plus a compatibility layer, which can limit some Google-dependent apps. It is a single all-or-nothing power switch rather than per-component control, so it is less granular than the Librem 5’s three switches.

Option 3: A well-configured mainstream phone

You can get much of the practical benefit without special hardware. A current iPhone or Pixel lets you disable the camera and microphone in software, cut the radios instantly with Airplane Mode, and, on iPhone, use Lockdown Mode to blunt advanced spyware. This is not as absolute as a severed circuit, because in principle sophisticated malware could work around a software toggle, but for the overwhelming majority of people it is more than enough, and you keep a phone that is pleasant to use every day.

Pair a mainstream phone with a Faraday bag for the moments you want a hard guarantee of radio silence, and you have covered most real-world needs at a fraction of the cost and inconvenience. For the strongest mainstream software option, see our phone operating-system hub and the guide to installing GrapheneOS on a Pixel.

How to decide

• Facing a credible spyware threat and want per-component guarantees? The Librem 5, accepting its usability cost.
• Want a hard “fully off” guarantee in a marketed bundle? The UP Phone, weighing its price and dated chipset first.
• Want occasional guaranteed silence cheaply? A Faraday bag with the phone you own.
• Want strong everyday privacy without the compromises? A well-configured mainstream phone.